Cybersecurity researchers have uncovered another malicious npm package linked to MALFEX, a long-running software supply chain attack campaign targeting Windows systems. The package, named imgdecode, uses a compiled Node.js addon to download encrypted malicious payloads, decrypt them, and inject shellcode into a legitimate Windows process.
According to cybersecurity firm SafeDep, imgdecode was uploaded to the npm registry on September 30, 2026, by a user operating under the name malfexteste8. At the time of reporting, the package had recorded 979 downloads and remained available on npm. Its latest identified version is 1.0.3.
“The npm package imgdecode hides a malicious loader in a compiled Node.js addon,” SafeDep said. The package contains only nine lines of JavaScript, but its primary function is to load a Windows dynamic-link library (DLL). When a Node.js application calls require('imgdecode') from a Windows console, the DLL attempts to retrieve encrypted shellcode from GitHub, decrypts the downloaded content, and injects it into a newly created dllhost.exe process.
The discovery highlights how threat actors are adapting their techniques to maintain access to malicious packages even after security researchers and npm moderators identify and remove earlier versions of their tools.
MALFEX Campaign Has Targeted npm Users Since 2023
First documented by Checkmarx and CloudSEK, MALFEX is the name given to a campaign in which an unidentified threat actor has published malicious packages to npm since August 6, 2023.
The campaign primarily targets Windows systems and has involved multiple npm publisher accounts, including:
malfexkkjmalfex_usermalfexteste2malfexteste3malfexteste4
Researchers identified eight packages associated with the campaign. Three were designed to act as loaders for Overlord RAT, while another group of three packages — cdn-img-fetch, img-to-native, and native-runner — worked together to download and execute a Node.js information stealer.
A separate infection method relied on a postinstall hook to run JavaScript that contacted an external server and retrieved an additional, unidentified binary payload.
The emergence of imgdecode suggests that the campaign’s operator is continuing to modify and replace its malware delivery infrastructure as earlier packages become publicly known.
Threat Actor Publishes Replacement Packages After npm Removals
One notable aspect of the MALFEX campaign is the apparent speed with which the operator responds to security disclosures and package removals.
After npm removed native-runner and img-to-native, the threat actor published replacement packages named runhelper and imgbundle. The first version of imgdecode appeared later on the same day, introducing another way to execute malicious code on Windows systems.
The following timeline outlines the relevant package activity:
- September 26, 2026: Versions 1.0.0 of
cdn-img-fetch,img-to-native, andnative-runnerwere published. - September 28, 2026, 4:06 p.m. UTC: npm removed
native-runnerandimg-to-native. - September 30, 2026, 3:29 a.m. UTC:
imgbundle1.0.0 was published as a replacement forimg-to-native. - September 30, 2026, 3:37 a.m. UTC:
runhelper1.0.0 was published as a replacement fornative-runner. - September 30, 2026, 4:13 p.m. UTC:
runhelperwas unpublished. - September 30, 2026, 10:32 p.m. UTC:
imgdecode1.0.0 was published. - September 30, 2026, 11:07 p.m. UTC:
imgdecode1.0.1 was published. - October 1, 2026, 5:48 p.m. UTC:
imgdecode1.0.2 was published. - October 7, 2026, 11:06 p.m. UTC: npm removed
imgbundle. - October 8, 2026, 1:03 p.m. UTC: npm removed
cdn-img-fetch. - October 11, 2026, 10:09 p.m. UTC:
imgdecode1.0.3 was published.
This sequence indicates that the campaign’s infrastructure has continued to evolve as individual components have been identified and removed.
How the MALFEX Node.js Stealer Chain Works
The Node.js information-stealing infection chain is particularly noteworthy because the identified packages do not rely on installation hooks to trigger their primary malicious activity. Instead, the code executes when native-runner is loaded.
The packages work together in a multi-stage process:
1. cdn-img-fetch Downloads an Encrypted Payload
The cdn-img-fetch package retrieves a file named banner.png from a GitHub repository called cavecrew/proj. The downloaded file contains an encrypted payload that is extracted for subsequent processing.
2. img-to-native Decrypts the Payload
The img-to-native package decrypts the extracted data using the key malfexteam2027. It then writes the resulting Go executable to the following location:
%APPDATA%\Microsoft\Windows\node_runtime_helper.exe
3. native-runner Executes the Downloader
The native-runner package launches the Go executable. This program subsequently downloads another executable, identified as setup.exe and associated with the malware name movinlike, from the address 104.234.65[.]75:700.
Together, these components create a multi-stage infection chain that uses seemingly ordinary Node.js dependencies to deliver and execute malicious software.
Runhelper Introduces an Alternative Shellcode Execution Method
The runhelper package was advertised as a utility for launching native binaries from Node.js projects. However, researchers found that it served a malicious purpose similar to that of native-runner.
Its primary function was to locate a JPG file at cdn-img-fetch/.runtime/rt.jpg, extract shellcode from the file, copy the shellcode into executable memory, and run it using Koffi, a Foreign Function Interface (FFI) module for Node.js.
This approach allows the malicious code to execute without requiring the payload to be launched as a conventional executable in the usual way.
SafeDep reported that the operator published imgdecode approximately six hours after runhelper was unpublished. The new package introduced a compiled DLL capable of handling shellcode execution.
imgdecode Evolves Into a Standalone Malware Loader
The imgdecode package changed across its successive releases, making it less dependent on other malicious packages.
According to SafeDep, version 1.0.0 waited for imgbundle to create a file in the cdn-img-fetch/.runtime/ directory. Once the file became available, the package read its contents into memory and passed the data to a native Node.js addon for decoding.
Versions 1.0.1 and 1.0.2 introduced additional functionality to download and decrypt the payload. Both versions still invoked require('imgbundle') before loading the DLL.
Version 1.0.3 removed this dependency, allowing the package to operate without requiring another MALFEX package.
SafeDep summarized the change by noting that the latest version no longer needs another package from the campaign to carry out its malicious functionality.
DLL Downloads and Injects Encrypted Shellcode
The native addon is a 64-bit Microsoft Visual C++ DLL. It first checks whether it is running from a developer’s terminal before proceeding with its payload retrieval and execution process.
The DLL then attempts to download a file named banner.jpg from the same GitHub repository, cavecrew/proj. It decrypts the embedded payload using the key nif-runtime-2027 and injects the resulting shellcode into dllhost.exe.
Researchers also identified a condition that could allow the operator to disable the loader remotely.
After decrypting the downloaded content, the DLL checks the initial bytes of the plaintext. If those bytes match a JPEG or PNG file signature, execution stops.
SafeDep suggested that the operator could use this behavior as a mechanism to deactivate the loader by serving encrypted content that decrypts into an image. Simply supplying an ordinary image would generally cause decryption to fail before the signature check.
GitHub Repository Linked to the Malware Delivery Chain
Although the GitHub account cavecrew is no longer accessible, an Internet Archive screenshot of an image file dated October 6, 2026, reportedly shows the same Go-based downloader used in the Node.js stealer infection chain.
The downloader was designed to retrieve the information stealer and remote access tool associated with movinlike from 104.234.65[.]75:700.
Researchers also found a .env file within the Node.js application containing a command-and-control (C2) address:
104.234.65[.]75:7007
The file also contained a MALFEX license key, suggesting that the payload may have been generated using a malware builder or licensing system.
These findings provide additional evidence connecting the npm packages to a broader malware delivery operation.
Malware Steals Credentials, Cryptocurrency Data, and Personal Files
The malware delivered through the campaign incorporates anti-analysis features intended to make investigation and detection more difficult.
It checks for signs of virtual machines, sandboxes, and security analysis tools, including Process Monitor and Wireshark, before proceeding with its malicious activities.
Once active, the information stealer searches for sensitive files and data from a broad range of applications and services.
Its collection targets reportedly include:
- Cryptocurrency recovery phrases: Files containing seed phrases that could provide access to digital assets.
- Sensitive files and credentials: Files with extensions such as
.kdbx,.pem,.ppk, and.env. - Web browser data: Information stored by Chromium-based browsers.
- Messaging applications: Data associated with Discord and Telegram.
- Cryptocurrency wallets: Wallet-related information that may expose digital assets to theft.
- Gaming platforms: Data associated with Steam, Epic Games, Riot, Battle.net, Minecraft, and Ubisoft.
The inclusion of cryptocurrency recovery phrases and wallet-related data is particularly concerning because stolen information may allow attackers to gain control of victims’ digital assets.
Remote Access Capabilities and Persistence Mechanisms
Beyond information theft, the malware can establish a WebSocket connection with its command-and-control server. This connection enables the operator to send commands to infected systems and remotely interact with them.
Reported capabilities include:
- Executing shell commands.
- Transferring files to and from compromised systems.
- Managing running processes.
- Accessing clipboard contents.
- Capturing screenshots.
- Controlling mouse and keyboard input.
The malware also uses persistence mechanisms to maintain access after a system restart.
It reportedly creates a Windows Registry Run key and schedules a task named MicrosoftEdgeUpdateService. These mechanisms can allow the malware to launch again automatically, making it important for defenders to inspect both Registry startup entries and scheduled tasks during incident response.
How Developers Can Protect Their Systems
Developers who installed or executed any of the identified MALFEX packages should treat affected Windows systems as potentially compromised.
Removing the npm package alone may not be sufficient because its payload could already have executed and established persistence.
Security teams and developers should take the following steps:
- Isolate potentially affected systems. Disconnect suspected machines from the network to limit further communication with the attacker’s infrastructure.
- Identify installed packages. Review project dependencies, lockfiles, npm installation records, and development environments for
imgdecode,imgbundle,runhelper,native-runner,img-to-native, andcdn-img-fetch. - Investigate persistence mechanisms. Examine Windows Registry Run keys, scheduled tasks, running processes, and unexpected files, including
node_runtime_helper.exe. - Check for signs of credential theft. Review relevant security logs and investigate suspicious access to browser profiles, messaging applications, cryptocurrency wallets, and sensitive files.
- Rotate potentially exposed credentials. From a known-clean device, change passwords, revoke active sessions and tokens, and rotate API keys, SSH keys, and other secrets that may have been accessible to the malware.
- Protect cryptocurrency assets. If seed phrases or wallet credentials may have been exposed, use a clean device to move assets to a newly created wallet with a new recovery phrase. Do not reuse a potentially compromised seed phrase.
- Rebuild systems when necessary. If malicious code executed or the extent of the compromise cannot be established, consider rebuilding the affected system from a trusted source.
Organizations should also review their software supply chain security practices. Pinning dependency versions, auditing package changes, using trusted registries and security scanning tools, and limiting the secrets available to development environments can help reduce the risk posed by malicious dependencies.
Conclusion
The MALFEX campaign demonstrates how attackers can exploit the trust developers place in open-source package ecosystems. By publishing malicious packages under seemingly legitimate names and replacing components after their removal, the operators have maintained multiple pathways for delivering malware to Windows systems.
The latest imgdecode release is particularly concerning because it no longer depends on other identified MALFEX packages. Its ability to retrieve encrypted payloads, inject shellcode into a Windows process, and support a broader information-stealing operation makes it a significant risk for developers who may have incorporated the package into their projects.
Developers should urgently review their dependencies for the identified packages and investigate any Windows environment in which the malicious code may have executed.
As software supply chain attacks continue to evolve, dependency verification, proactive monitoring, and rapid incident response remain essential to protecting development environments and the sensitive information they contain.
